Never treat an identifier alone as proof; cross-check before acting.
The threat
the caller presents a spoofed number or call identifier (Caller ID, ANI) to pass as a known or legitimate source before any verification. Impersonation is automatable at scale over a voice channel.
Blind spotWhy classic frameworks miss it
frameworks treat the call identifier as a trusted attribute; over a voice channel the number is data produced by the attacker, not proof. This is entry spoofing, not a downstream authentication flaw.
MitigationProposed approach
never treat an identifier alone (number, ANI) as proof of identity; cross-check with known context (CRM), out-of-band verification or a challenge on every sensitive action; a progressive trust policy based on the action's risk.
The proposed control
no sensitive action validated on the identifier alone.
Expected evidence
trace that spoofing the number is no longer enough to trigger a critical action.